micro-models-agent 1.5.0 → 1.7.0

package/dist/main.js

@@ -2312,6 +2312,7 @@ var init_defaults = __esm(() => {
         description: "browser + file reading for visual tasks"
       }
     },
+    modelCapabilities: {},
     contextWindow: 32768,
     contextBudget: {
       systemPrompt: 0.1,
@@ -2729,7 +2730,7 @@ Fix the error and re-edit the file (a clean write clears the failure), or mark t
     "cli.config_key": "Config key (e.g., model, provider.baseUrl)",
     "cli.set_value": "Set a config value",
     "cli.set_done": "Set {key}={value}",
-    "cli.show_config": "Show current config",
+    "cli.show_config": "Show the effective configuration (secrets redacted; use --show-secrets to reveal)",
     "cli.migrate_config": "Migrate legacy config.json to domain format",
     "cli.manage_models": "Manage models",
     "cli.list_models": "List available models",
@@ -2804,6 +2805,7 @@ Fix the error and re-edit the file (a clean write clears the failure), or mark t
     "cli.show_details": "Show session details",
     "cli.delete_session": "Delete a session",
     "cli.first_run": "First run detected. Running setup wizard...",
+    "cli.first_run_oneshot": "No configuration found — running with defaults. Run `mma` (no arguments) once to set up the wizard.",
     "cli.setup_saved_restart": "Settings saved. Restarting with the new configuration...",
     "cli.unknown_cmd": "Unknown command: {name}.",
     "cli.unknown_command": 'Unknown command "{input}". Did you mean "{suggestion}"?',
@@ -3028,7 +3030,7 @@ Excluded blocks: {count}`,
     "setup.security_configure": "  Configure security? (y/N)",
     "setup.security_bash_block": "  Block dangerous commands (rm, sudo, ssh, etc.)? (y/N)",
     "setup.security_flags_block": "  Block dangerous flags (--force, -rf, etc.)? (y/N)",
-    "setup.security_paths_deny": "  Allow access to .git/, .env, node_modules/? (y/N)",
+    "setup.security_paths_restrict": "  Restrict access to .git/, .env, node_modules/? (Y/n)",
     "skill.already_loaded": 'Skill "{name}" is already loaded',
     "skill.not_found": 'Skill "{name}" not found in any source directory',
     "skill.no_match": "No skills match for: {task}",
@@ -3605,7 +3607,7 @@ var init_ru = __esm(() => {
     "cli.config_key": "Ключ конфига (напр., model, provider.baseUrl)",
     "cli.set_value": "Установить значение",
     "cli.set_done": "Установлено {key}={value}",
-    "cli.show_config": "Показать текущий конфиг",
+    "cli.show_config": "Показать действующую конфигурацию (секреты скрыты; используйте --show-secrets)",
     "cli.migrate_config": "Мигрировать legacy config.json в domain-формат",
     "cli.manage_models": "Управление моделями",
     "cli.list_models": "Список доступных моделей",
@@ -3676,6 +3678,7 @@ var init_ru = __esm(() => {
     "cli.show_details": "Показать детали сессии",
     "cli.delete_session": "Удалить сессию",
     "cli.first_run": "Первый запуск. Запускаем мастер настройки...",
+    "cli.first_run_oneshot": "Конфигурация не найдена — запуск с настройками по умолчанию. Запустите `mma` без аргументов один раз для настройки.",
     "cli.setup_saved_restart": "Настройки сохранены. Перезапуск с новой конфигурацией...",
     "cli.unknown_cmd": "Неизвестная команда: {name}.",
     "cli.unknown_command": 'Неизвестная команда "{input}". Возможно, вы имели в виду "{suggestion}"?',
@@ -3904,7 +3907,7 @@ var init_ru = __esm(() => {
     "setup.security_configure": "  Настроить безопасность? (y/N)",
     "setup.security_bash_block": "  Блокировать опасные команды (rm, sudo, ssh и т.д.)? (y/N)",
     "setup.security_flags_block": "  Блокировать опасные флаги (--force, -rf и т.д.)? (y/N)",
-    "setup.security_paths_deny": "  Разрешить доступ к .git/, .env, node_modules/? (y/N)",
+    "setup.security_paths_restrict": "  Ограничить доступ к .git/, .env, node_modules/? (Y/n)",
     "skill.already_loaded": 'Скилл "{name}" уже загружен',
     "skill.not_found": 'Скилл "{name}" не найден ни в одном каталоге',
     "skill.no_match": "Нет скиллов подходящих для: {task}",
@@ -5116,7 +5119,7 @@ var init_domains = __esm(() => {
       "reasoning",
       "hallucination"
     ],
-    provider: ["provider", "orchestrator", "retry", "pricing"],
+    provider: ["provider", "orchestrator", "retry", "pricing", "modelCapabilities"],
     moe: ["moe", "experts"],
     security: ["security"],
     browser: ["browser"],
@@ -5324,9 +5327,6 @@ function loadConfig(options) {
     config = deepMerge(config, domainConfig);
     legacyDetected = false;
   }
-  if (!globalData && !domainConfig) {
-    saveDomainFiles(config, options.configDir);
-  }
   const projectData = loadJSON(options.projectConfigPath);
   if (projectData) {
     config = deepMerge(config, projectData);
@@ -7548,7 +7548,7 @@ var init_factory = __esm(() => {
 });
 
 // src/llm/model-loader.ts
-async function getLoadedContextLength(baseUrl, model, timeoutMs = 3000) {
+async function probeModel(baseUrl, model, timeoutMs = 3000) {
   const base = baseUrl.replace(/\/$/, "").replace(/\/v1\/?$/, "");
   try {
     const response = await fetch(`${base}/api/v1/models`, {
@@ -7562,10 +7562,18 @@ async function getLoadedContextLength(baseUrl, model, timeoutMs = 3000) {
     if (!found)
       return null;
     const loadedInstance = (found.loaded_instances ?? [])[0];
-    const actual = loadedInstance?.config?.context_length ?? found.max_context_length;
-    if (typeof actual !== "number" || actual <= 0)
+    const contextLength = loadedInstance?.config?.context_length ?? found.max_context_length;
+    if (typeof contextLength !== "number" || contextLength <= 0)
       return null;
-    return { model: found.key ?? found.name ?? model, actual };
+    const raw = found.capabilities;
+    let capabilities;
+    if (raw && typeof raw.vision === "boolean") {
+      capabilities = { vision: raw.vision };
+      if (typeof raw.trained_for_tool_use === "boolean") {
+        capabilities.tools = raw.trained_for_tool_use;
+      }
+    }
+    return { model: found.key ?? found.name ?? model, contextLength, capabilities };
   } catch {
     return null;
   }
@@ -15437,6 +15445,15 @@ var init_tool_output = __esm(() => {
   init_i18n();
 });
 
+// src/core/agent/tool-images.ts
+function queueToolImages(sink, images) {
+  if (!sink || !images || images.length === 0)
+    return;
+  for (const image of images) {
+    sink.addPendingImage(image);
+  }
+}
+
 // src/core/agent/tool-batch.ts
 class ToolBatchExecutor {
   deps;
@@ -15566,6 +15583,7 @@ class ToolBatchExecutor {
         arguments: call.arguments
       });
       answeredToolCallIds.add(call.id);
+      queueToolImages(contextManager, result.images);
       const tokensAfterTool = contextManager.getEstimatedTokens();
       const costAfterTool = this.deps.costTracker.total;
       onTool?.({
@@ -21291,6 +21309,119 @@ var init_session = __esm(() => {
   init_i18n();
 });
 
+// src/llm/image-utils.ts
+var exports_image_utils = {};
+__export(exports_image_utils, {
+  readClipboardImage: () => readClipboardImage,
+  loadUrlAsDataUrl: () => loadUrlAsDataUrl,
+  loadFileAsDataUrl: () => loadFileAsDataUrl,
+  detectMime: () => detectMime,
+  bufferToDataUrl: () => bufferToDataUrl
+});
+import { readFileSync as readFileSync20 } from "fs";
+import { extname as extname4 } from "path";
+function detectMime(filePath) {
+  const ext = extname4(filePath).toLowerCase();
+  return MIME_MAP[ext] ?? "image/png";
+}
+async function readClipboardImage() {
+  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
+    try {
+      const img = Bun.Image.fromClipboard();
+      if (img) {
+        const buf = await img.resize(800, 800, { fit: "inside" }).jpeg({ quality: 60 }).buffer();
+        return Buffer.from(buf);
+      }
+    } catch {}
+  }
+  return readClipboardFallback();
+}
+async function readClipboardFallback() {
+  const { platform: platform7 } = await import("os");
+  const { execSync } = await import("child_process");
+  const { readFileSync: readFileSync21, unlinkSync: unlinkSync5 } = await import("fs");
+  const { join: join29 } = await import("path");
+  if (platform7() !== "linux")
+    return null;
+  const tmpPath = join29(process.env.TEMP || process.env.TMP || "/tmp", `mma-clip-${Date.now()}.png`);
+  const commands = [
+    `wl-paste --type image/png > "${tmpPath}" 2>/dev/null`,
+    `xclip -selection clipboard -t image/png -o > "${tmpPath}" 2>/dev/null`
+  ];
+  for (const cmd of commands) {
+    try {
+      execSync(cmd, { timeout: 5000 });
+      const buf = readFileSync21(tmpPath);
+      unlinkSync5(tmpPath);
+      if (buf.length > 0)
+        return buf;
+    } catch {}
+  }
+  try {
+    unlinkSync5(tmpPath);
+  } catch {}
+  return null;
+}
+async function loadFileAsDataUrl(filePath) {
+  const buf = readFileSync20(filePath);
+  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
+    try {
+      const img = new Bun.Image(buf);
+      const { width } = await img.metadata();
+      const targetWidth = Math.min(800, width || 800);
+      const dataUrl = await img.resize(targetWidth, 800, { fit: "inside" }).jpeg({ quality: 60 }).dataurl();
+      return { dataUrl };
+    } catch {}
+  }
+  const b64 = buf.toString("base64");
+  const ext = filePath.split(".").pop()?.toLowerCase();
+  const mime = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : ext === "webp" ? "image/webp" : "image/png";
+  return { dataUrl: `data:${mime};base64,${b64}` };
+}
+async function loadUrlAsDataUrl(url) {
+  const resp = await fetch(url);
+  if (!resp.ok) {
+    throw new Error(`Failed to fetch image: ${resp.status} ${resp.statusText}`);
+  }
+  const buf = Buffer.from(await resp.arrayBuffer());
+  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
+    try {
+      const img = new Bun.Image(buf);
+      const { width } = await img.metadata();
+      const targetWidth = Math.min(800, width || 800);
+      const dataUrl = await img.resize(targetWidth, 800, { fit: "inside" }).jpeg({ quality: 60 }).dataurl();
+      return { dataUrl };
+    } catch {}
+  }
+  const b64 = buf.toString("base64");
+  return { dataUrl: `data:image/png;base64,${b64}` };
+}
+async function bufferToDataUrl(buf) {
+  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
+    try {
+      const img = new Bun.Image(buf);
+      const { width } = await img.metadata();
+      const targetWidth = Math.min(800, width || 800);
+      const dataUrl = await img.resize(targetWidth, 800, { fit: "inside" }).jpeg({ quality: 60 }).dataurl();
+      return { dataUrl };
+    } catch {}
+  }
+  const b64 = buf.toString("base64");
+  return { dataUrl: `data:image/png;base64,${b64}` };
+}
+var MIME_MAP;
+var init_image_utils = __esm(() => {
+  MIME_MAP = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".bmp": "image/bmp",
+    ".svg": "image/svg+xml"
+  };
+});
+
 // src/tools/browser.ts
 import { join as join29 } from "path";
 import { mkdirSync as mkdirSync16 } from "fs";
@@ -21327,18 +21458,9 @@ function formatScreenshotForTextModel(snapshot) {
 
 ${snapshot}`;
 }
-function modelSupportsVision(model) {
-  const m = model.toLowerCase();
-  return /vision|\bvl\b|qwen.*vl|gpt-4|claude|gemini|llava|pixtral/.test(m);
-}
-function formatScreenshotResult(snapshot, screenshot, supportsVision) {
-  if (!supportsVision) {
-    return formatScreenshotForTextModel(snapshot);
-  }
-  const base642 = screenshot.toString("base64");
-  return `${snapshot}
-
-[Screenshot: data:image/png;base64,${base642}]`;
+async function screenshotToImagePart(screenshot) {
+  const { dataUrl } = await bufferToDataUrl(screenshot);
+  return { type: "image_url", image_url: { url: dataUrl } };
 }
 function createBrowserTool() {
   return {
@@ -21403,12 +21525,15 @@ function createBrowserTool() {
       }
       const s = getSession(ctx);
       const result = await serialize(() => s.execute(action, args));
-      const supportsVision = modelSupportsVision(ctx.config.model);
       if (result.screenshot) {
-        return {
-          success: result.success,
-          output: formatScreenshotResult(result.output, result.screenshot, supportsVision)
-        };
+        if (ctx.capabilities?.vision) {
+          return {
+            success: result.success,
+            output: result.output,
+            images: [await screenshotToImagePart(result.screenshot)]
+          };
+        }
+        return { success: result.success, output: formatScreenshotForTextModel(result.output) };
       }
       return { success: result.success, output: result.output };
     }
@@ -21427,125 +21552,13 @@ var session = null, sessionFactory, actionChain;
 var init_browser = __esm(() => {
   init_session();
   init_types();
+  init_image_utils();
   init_i18n();
   init_output();
   init_utils();
   actionChain = Promise.resolve();
 });
 
-// src/llm/image-utils.ts
-var exports_image_utils = {};
-__export(exports_image_utils, {
-  readClipboardImage: () => readClipboardImage,
-  loadUrlAsDataUrl: () => loadUrlAsDataUrl,
-  loadFileAsDataUrl: () => loadFileAsDataUrl,
-  detectMime: () => detectMime,
-  bufferToDataUrl: () => bufferToDataUrl
-});
-import { readFileSync as readFileSync20 } from "fs";
-import { extname as extname4 } from "path";
-function detectMime(filePath) {
-  const ext = extname4(filePath).toLowerCase();
-  return MIME_MAP[ext] ?? "image/png";
-}
-async function readClipboardImage() {
-  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
-    try {
-      const img = Bun.Image.fromClipboard();
-      if (img) {
-        const buf = await img.resize(800, 800, { fit: "inside" }).jpeg({ quality: 60 }).buffer();
-        return Buffer.from(buf);
-      }
-    } catch {}
-  }
-  return readClipboardFallback();
-}
-async function readClipboardFallback() {
-  const { platform: platform7 } = await import("os");
-  const { execSync } = await import("child_process");
-  const { readFileSync: readFileSync21, unlinkSync: unlinkSync5 } = await import("fs");
-  const { join: join30 } = await import("path");
-  if (platform7() !== "linux")
-    return null;
-  const tmpPath = join30(process.env.TEMP || process.env.TMP || "/tmp", `mma-clip-${Date.now()}.png`);
-  const commands = [
-    `wl-paste --type image/png > "${tmpPath}" 2>/dev/null`,
-    `xclip -selection clipboard -t image/png -o > "${tmpPath}" 2>/dev/null`
-  ];
-  for (const cmd of commands) {
-    try {
-      execSync(cmd, { timeout: 5000 });
-      const buf = readFileSync21(tmpPath);
-      unlinkSync5(tmpPath);
-      if (buf.length > 0)
-        return buf;
-    } catch {}
-  }
-  try {
-    unlinkSync5(tmpPath);
-  } catch {}
-  return null;
-}
-async function loadFileAsDataUrl(filePath) {
-  const buf = readFileSync20(filePath);
-  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
-    try {
-      const img = new Bun.Image(buf);
-      const { width } = await img.metadata();
-      const targetWidth = Math.min(800, width || 800);
-      const dataUrl = await img.resize(targetWidth, 800, { fit: "inside" }).jpeg({ quality: 60 }).dataurl();
-      return { dataUrl };
-    } catch {}
-  }
-  const b64 = buf.toString("base64");
-  const ext = filePath.split(".").pop()?.toLowerCase();
-  const mime = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : ext === "webp" ? "image/webp" : "image/png";
-  return { dataUrl: `data:${mime};base64,${b64}` };
-}
-async function loadUrlAsDataUrl(url) {
-  const resp = await fetch(url);
-  if (!resp.ok) {
-    throw new Error(`Failed to fetch image: ${resp.status} ${resp.statusText}`);
-  }
-  const buf = Buffer.from(await resp.arrayBuffer());
-  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
-    try {
-      const img = new Bun.Image(buf);
-      const { width } = await img.metadata();
-      const targetWidth = Math.min(800, width || 800);
-      const dataUrl = await img.resize(targetWidth, 800, { fit: "inside" }).jpeg({ quality: 60 }).dataurl();
-      return { dataUrl };
-    } catch {}
-  }
-  const b64 = buf.toString("base64");
-  return { dataUrl: `data:image/png;base64,${b64}` };
-}
-async function bufferToDataUrl(buf) {
-  if (typeof Bun !== "undefined" && typeof Bun.Image !== "undefined") {
-    try {
-      const img = new Bun.Image(buf);
-      const { width } = await img.metadata();
-      const targetWidth = Math.min(800, width || 800);
-      const dataUrl = await img.resize(targetWidth, 800, { fit: "inside" }).jpeg({ quality: 60 }).dataurl();
-      return { dataUrl };
-    } catch {}
-  }
-  const b64 = buf.toString("base64");
-  return { dataUrl: `data:image/png;base64,${b64}` };
-}
-var MIME_MAP;
-var init_image_utils = __esm(() => {
-  MIME_MAP = {
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".webp": "image/webp",
-    ".bmp": "image/bmp",
-    ".svg": "image/svg+xml"
-  };
-});
-
 // src/tools/attach-image.ts
 import { existsSync as existsSync35 } from "fs";
 import { resolve as resolve17 } from "path";
@@ -25292,7 +25305,7 @@ class BrowserModule {
         "Workflow: open(url) → read snapshot → click/type on element numbers → read updated snapshot.",
         'Each snapshot includes a "Content" section with the visible page text, a "Console" section with browser messages, and network errors. Use these to understand the page, detect JS errors, and verify the result of your actions.',
         'Always start with "open" action. Use element numbers from snapshot for click/type targets.',
-        'Use "screenshot" action only if the model supports vision. Otherwise rely on the text snapshot.'
+        'The "screenshot" action is delivered automatically: a vision model receives the image, a text-only model receives the text snapshot instead. You do not need to decide — just call it and read what you get.'
       ].join(`
 `),
       priority: "normal",
@@ -27705,6 +27718,19 @@ var init_context_log = __esm(() => {
   SEP2 = "─".repeat(78);
 });
 
+// src/modules/providers/capabilities.ts
+function resolveModelCapabilities(preset, probe, override) {
+  const base = preset ? { vision: preset.vision, tools: preset.tools } : { ...DEFAULT_MODEL_CAPABILITIES };
+  return { ...base, ...probe ?? {}, ...override ?? {} };
+}
+var DEFAULT_MODEL_CAPABILITIES;
+var init_capabilities = __esm(() => {
+  DEFAULT_MODEL_CAPABILITIES = {
+    vision: false,
+    tools: false
+  };
+});
+
 // src/core/environment.ts
 import { existsSync as existsSync50, readFileSync as readFileSync32, readdirSync as readdirSync16 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
@@ -28336,7 +28362,9 @@ function buildSystemInfo(config, baseDir, profileCompressed) {
   lines.push(`Runtime verification: when a bug is described in terms of runtime behavior (what happens when the app runs), reproduce it — run the app / build / browser tool — and confirm the fix against actual runtime output before calling "plan update step=N status=done". Check existing servers first with process_list/process_log: a stale dev server started BEFORE your change still runs the old pipeline and keeps failing even after the files on disk are fixed. Restart or kill it (process_kill) and verify the exact endpoint/port the user reported — a fresh server on a new port does NOT prove the user's error is gone.`);
   const sec = config.security;
   if (sec?.enabled) {
-    const secLines = [`SECURITY RESTRICTIONS (enforced — blocked calls return "[SECURITY BLOCKED]", do not retry them):`];
+    const secLines = [
+      `SECURITY RESTRICTIONS (enforced — blocked calls return "[SECURITY BLOCKED]", do not retry them):`
+    ];
     if (sec.bash?.enabled && sec.bash.blacklist.length > 0) {
       const cmds = sec.bash.blacklist.slice(0, 15).join(", ");
       secLines.push(`Forbidden bash commands: ${cmds}${sec.bash.blacklist.length > 15 ? ", …" : ""}.`);
@@ -28418,19 +28446,23 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete, reas
       logger4.info(t("env.model_loaded", { model: config.model, seconds: String(loadResult.loadTime) }));
     }
   }
+  const capabilitiesRef = {};
   const contextProbePromise = (async () => {
     try {
-      const probe = await getLoadedContextLength(config.provider.baseUrl, config.model);
+      const probe = await probeModel(config.provider.baseUrl, config.model);
       if (!probe)
         return null;
-      if (probe.actual < config.contextWindow) {
-        logger4.logSilent("warn", `Context probe: model "${probe.model}" is loaded with ${probe.actual} tokens, but contextWindow is configured as ${config.contextWindow} — overflow/429 risk. Lower contextWindow or reload the model with a larger context.`);
-      } else if (probe.actual > config.contextWindow) {
-        logger4.logSilent("info", `Context probe: model "${probe.model}" supports ${probe.actual} tokens — consider "mma context ${probe.actual}" to use the full window.`);
+      if (probe.capabilities)
+        capabilitiesRef.probe = probe.capabilities;
+      const contextProbe = { model: probe.model, actual: probe.contextLength };
+      if (probe.contextLength < config.contextWindow) {
+        logger4.logSilent("warn", `Context probe: model "${probe.model}" is loaded with ${probe.contextLength} tokens, but contextWindow is configured as ${config.contextWindow} — overflow/429 risk. Lower contextWindow or reload the model with a larger context.`);
+      } else if (probe.contextLength > config.contextWindow) {
+        logger4.logSilent("info", `Context probe: model "${probe.model}" supports ${probe.contextLength} tokens — consider "mma context ${probe.contextLength}" to use the full window.`);
       } else {
-        logger4.logSilent("debug", `Context probe: configured contextWindow matches loaded context (${probe.actual})`);
+        logger4.logSilent("debug", `Context probe: configured contextWindow matches loaded context (${probe.contextLength})`);
       }
-      return probe;
+      return contextProbe;
     } catch {
       return null;
     }
@@ -28609,6 +28641,14 @@ async function bootstrap(configDir, projectDir, noAgentsMd, exitOnComplete, reas
     get: () => sessionManager,
     configurable: true
   });
+  Object.defineProperty(toolCtx, "capabilities", {
+    get: () => {
+      const cfg = configRef.current;
+      const spec = BUILTIN_PROVIDERS.find((p) => p.type === cfg.provider.type);
+      return resolveModelCapabilities(spec?.capabilities, capabilitiesRef.probe, cfg.modelCapabilities?.[cfg.model]);
+    },
+    configurable: true
+  });
   const toolExecutor = new ToolExecutor(toolRegistry, toolCtx, pluginManager);
   toolCtx.llmProvider = llmProvider;
   toolCtx.toolExecutor = toolExecutor;
@@ -28832,6 +28872,7 @@ var init_bootstrap = __esm(() => {
   init_i18n();
   init_agent();
   init_context_log();
+  init_capabilities();
   init_version();
   init_environment();
   init_utils();
@@ -29592,11 +29633,12 @@ async function runSetup(externalRl) {
   const configureSecurity = await ask(rl, t("setup.security_configure"), "n");
   let securityBashBlock = false;
   let securityFlagsBlock = false;
-  let securityPathsDeny = true;
+  let securityPathsRestrict = false;
   if (configureSecurity.toLowerCase() === "y" || configureSecurity.toLowerCase() === "yes") {
     securityBashBlock = (await ask(rl, t("setup.security_bash_block"), "n")).toLowerCase() === "y";
     securityFlagsBlock = (await ask(rl, t("setup.security_flags_block"), "n")).toLowerCase() === "y";
-    securityPathsDeny = (await ask(rl, t("setup.security_paths_deny"), "Y")).toLowerCase() !== "n";
+    const pathsAnswer = (await ask(rl, t("setup.security_paths_restrict"), "Y")).toLowerCase();
+    securityPathsRestrict = pathsAnswer !== "n" && pathsAnswer !== "no";
   }
   if (ownRl) {
     rl.close();
@@ -29611,7 +29653,7 @@ async function runSetup(externalRl) {
     locale,
     securityBashBlock,
     securityFlagsBlock,
-    securityPathsDeny
+    securityPathsRestrict
   };
   getDefaultChannel().writeLine(pc.green(pc.bold(t("setup.complete"))));
   const summary = [
@@ -29652,6 +29694,73 @@ var init_setup = __esm(() => {
   ];
 });
 
+// src/cli/setup-order.ts
+function applyAnswersToConfig(config, a) {
+  config.provider = {
+    ...config.provider,
+    type: a.provider,
+    baseUrl: a.apiBase,
+    apiKey: a.apiKey
+  };
+  config.model = a.model;
+  config.contextWindow = a.contextWindow;
+  config.maxToolIterations = a.maxToolIterations;
+  config.locale = a.locale;
+  if ((config.provider.entries?.length ?? 0) > 0) {
+    const entries = config.provider.entries ?? [];
+    const activeName = config.provider.active || entries[0]?.label || entries[0]?.type;
+    const idx = entries.findIndex((e) => e.label === activeName || e.type === activeName);
+    const target = idx >= 0 ? idx : 0;
+    const current = entries[target];
+    const keepLabel = Boolean(current.label && current.label !== current.type);
+    const updated = {
+      ...current,
+      type: a.provider,
+      baseUrl: a.apiBase,
+      apiKey: a.apiKey,
+      contextWindow: a.contextWindow,
+      ...keepLabel ? {} : { label: a.provider }
+    };
+    const next = entries.slice();
+    next[target] = updated;
+    config.provider.entries = next;
+    config.provider.active = updated.label || updated.type;
+  }
+  if (config.security) {
+    config.security.enabled = true;
+    config.security.bash.enabled = true;
+    config.security.bash.blockDangerousFlags = a.securityFlagsBlock || config.security.bash.blockDangerousFlags;
+    if (a.securityBashBlock) {
+      config.security.bash.blacklist = [
+        ...new Set([...config.security.bash.blacklist, ...SECURITY_BASH_BLOCKLIST])
+      ];
+    }
+    config.security.paths.enabled = a.securityPathsRestrict;
+  }
+  return config;
+}
+var SECURITY_BASH_BLOCKLIST;
+var init_setup_order = __esm(() => {
+  SECURITY_BASH_BLOCKLIST = [
+    "rm",
+    "dd",
+    "chmod",
+    "wget",
+    "curl",
+    "scp",
+    "ssh",
+    "nc",
+    "netcat",
+    "sudo",
+    "su",
+    "kill",
+    "pkill",
+    "killall",
+    "shutdown",
+    "reboot"
+  ];
+});
+
 // src/modules/indexer/map-command.ts
 async function runMapAction(module, action, query) {
   const summary = async () => {
@@ -37947,7 +38056,7 @@ __export(exports_repl_commands, {
   registerAllCommands: () => registerAllCommands,
   COMMAND_GROUPS: () => COMMAND_GROUPS
 });
-import { join as join54, dirname as dirname25 } from "path";
+import { join as join55, dirname as dirname25 } from "path";
 import { existsSync as existsSync60 } from "fs";
 function registerAllCommands(ctx) {
   registerBuiltinCommands(ctx);
@@ -38148,14 +38257,8 @@ function registerConfigCommands(ctx) {
       ctx.output.writeLine(pc.yellow(t("repl.wizard_running")));
       await ctx.withExclusiveInput(async () => {
         const answers = await runSetup(ctx.rl);
-        const configPath = join54(ctx.configDir, "config.json");
-        ctx.config.provider.type = answers.provider;
-        ctx.config.provider.baseUrl = answers.apiBase;
-        ctx.config.provider.apiKey = answers.apiKey;
-        ctx.config.model = answers.model;
-        ctx.config.contextWindow = answers.contextWindow;
-        ctx.config.maxToolIterations = answers.maxToolIterations;
-        ctx.config.locale = answers.locale;
+        const configPath = join55(ctx.configDir, "config.json");
+        applyAnswersToConfig(ctx.config, answers);
         saveConfig(ctx.config, configPath, dirname25(configPath));
         await ctx.agent.reconfigure(ctx.config);
         ctx.output.writeLine(pc.green(t("cli.config_saved")));
@@ -38279,7 +38382,7 @@ function registerProviderCommands(ctx) {
     });
     ctx.config.provider.entries = entries;
     ctx.config.provider.active = ctx.config.provider.active || ctx.config.provider.type;
-    const configPath = join54(ctx.configDir, "config.json");
+    const configPath = join55(ctx.configDir, "config.json");
     saveConfig(ctx.config, configPath, dirname25(configPath));
     await ctx.agent.reconfigure(ctx.config);
     ctx.output.writeLine(pc.green(t("cli.provider_added", { name })));
@@ -38346,7 +38449,7 @@ function registerProviderCommands(ctx) {
       return;
     }
     ctx.config.model = name;
-    const configPath = join54(ctx.configDir, "config.json");
+    const configPath = join55(ctx.configDir, "config.json");
     saveConfig(ctx.config, configPath, dirname25(configPath));
     await ctx.agent.reconfigure(ctx.config);
     ctx.output.writeLine(pc.green(t("repl.model_set", { name })));
@@ -38375,7 +38478,7 @@ function registerProviderCommands(ctx) {
     usage: t("repl.context_usage"),
     action: async (args) => {
       const save = async () => {
-        const configPath = join54(ctx.configDir, "config.json");
+        const configPath = join55(ctx.configDir, "config.json");
         saveConfig(ctx.config, configPath, dirname25(configPath));
         await ctx.agent.reconfigure(ctx.config);
       };
@@ -38768,11 +38871,11 @@ function registerSkillCommands(ctx) {
   });
 }
 async function runConfigMigrate(ctx) {
-  const { hasDomainFiles: hasDomainFiles3 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
+  const { hasDomainFiles: hasDomainFiles2 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
   const { loadConfig: loadCfg } = await Promise.resolve().then(() => (init_config2(), exports_config));
   const configDir = ctx.configDir;
-  const configPath = join54(configDir, "config.json");
-  if (hasDomainFiles3(configDir)) {
+  const configPath = join55(configDir, "config.json");
+  if (hasDomainFiles2(configDir)) {
     ctx.output.writeLine(pc.yellow(t("config.migrate_no_legacy")));
     return;
   }
@@ -38781,11 +38884,11 @@ async function runConfigMigrate(ctx) {
     return;
   }
   ctx.output.writeLine(t("config.migrate_start"));
-  const { config } = loadCfg({ configDir, projectConfigPath: join54(configDir, ".mmrc") });
+  const { config } = loadCfg({ configDir, projectConfigPath: join55(configDir, ".mmrc") });
   saveConfig(config, configPath, configDir);
-  const { renameSync: renameSync4, readdirSync: readdirSync19 } = await import("fs");
+  const { renameSync: renameSync4, readdirSync: readdirSync20 } = await import("fs");
   renameSync4(configPath, configPath + ".bak");
-  const domainFiles = readdirSync19(join54(configDir, "config")).filter((f) => f.endsWith(".json"));
+  const domainFiles = readdirSync20(join55(configDir, "config")).filter((f) => f.endsWith(".json"));
   ctx.output.writeLine(pc.green(t("config.migrate_done", { count: String(domainFiles.length) })));
 }
 var version2, COMMAND_GROUPS;
@@ -38795,6 +38898,7 @@ var init_repl_commands = __esm(() => {
   init_table();
   init_i18n();
   init_setup();
+  init_setup_order();
   init_config2();
   init_presets();
   init_budget();
@@ -38850,6 +38954,7 @@ var {
 init_bootstrap();
 init_config2();
 init_setup();
+init_setup_order();
 init_i18n();
 init_colors();
 import { join as join53, dirname as dirname24 } from "path";
@@ -39363,7 +39468,7 @@ function createSecurityCommand(program2) {
     const auditNotifier = security.auditNotifier || {};
     getDefaultChannel().writeLine(t("cli.security.current_policy"));
     getDefaultChannel().writeLine(`  ${t("cli.security.bash_enabled")}: ${bash.blacklist?.length > 0 ? t("cli.yes") : t("cli.no")}`);
-    getDefaultChannel().writeLine(`  ${t("cli.security.path_validation")}: ${paths.denied?.length > 0 ? t("cli.yes") : t("cli.no")}`);
+    getDefaultChannel().writeLine(`  ${t("cli.security.path_validation")}: ${paths.enabled ? t("cli.yes") : t("cli.no")}`);
     getDefaultChannel().writeLine(`  ${t("cli.security.network_validation")}: ${network.deniedDomains?.length > 0 || network.allowedDomains?.length > 0 ? t("cli.yes") : t("cli.no")}`);
     getDefaultChannel().writeLine(`  ${t("cli.security.content_scanning")}: ${contentScan.enabled ? t("cli.yes") : t("cli.no")}`);
     getDefaultChannel().writeLine(`  ${t("cli.security.max_recursion")}: ${security.maxRecursionDepth ?? 3}`);
@@ -39671,50 +39776,60 @@ function extractLatestChangelog(changelog) {
 
 // src/cli/commands.ts
 init_output();
+
+// src/config/redact.ts
+var SECRET_KEYS = new Set([
+  "apiKey",
+  "api_key",
+  "apikey",
+  "token",
+  "tokens",
+  "secret",
+  "password",
+  "authorization",
+  "webhookUrl"
+]);
+var SECRET_MAPS = new Set(["headers", "env"]);
+var MASK = "***";
+function walk(value, parentKey, depth = 0) {
+  if (depth > 100)
+    return value;
+  if (typeof value === "string") {
+    return parentKey && SECRET_KEYS.has(parentKey) ? MASK : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => walk(v, parentKey, depth + 1));
+  }
+  if (value && typeof value === "object" && !(value instanceof RegExp)) {
+    if (parentKey && SECRET_MAPS.has(parentKey)) {
+      const masked = {};
+      for (const k of Object.keys(value))
+        masked[k] = MASK;
+      return masked;
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = walk(v, k, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function redactConfigSecrets(config) {
+  return walk(config);
+}
+
+// src/cli/commands.ts
 var version = readMmaVersion();
+function configForDisplay(config, showSecrets) {
+  return showSecrets ? config : redactConfigSecrets(config);
+}
 function buildInitCommand(program2) {
   program2.command("init").description(t("cli.init")).action(async () => {
     const answers = await runSetup();
     const configPath = join53(homedir17(), ".mma", "config.json");
     const { config } = await bootstrap();
-    config.provider.type = answers.provider;
-    config.provider.baseUrl = answers.apiBase;
-    config.provider.apiKey = answers.apiKey;
-    config.model = answers.model;
-    config.contextWindow = answers.contextWindow;
-    config.maxToolIterations = answers.maxToolIterations;
-    config.locale = answers.locale;
-    if (config.security) {
-      config.security.enabled = true;
-      config.security.bash.enabled = true;
-      config.security.bash.blockDangerousFlags = answers.securityFlagsBlock || config.security.bash.blockDangerousFlags;
-      if (answers.securityBashBlock) {
-        config.security.bash.blacklist = [
-          ...new Set([
-            ...config.security.bash.blacklist,
-            "rm",
-            "dd",
-            "chmod",
-            "wget",
-            "curl",
-            "scp",
-            "ssh",
-            "nc",
-            "netcat",
-            "sudo",
-            "su",
-            "kill",
-            "pkill",
-            "killall",
-            "shutdown",
-            "reboot"
-          ])
-        ];
-      }
-      if (!answers.securityPathsDeny) {
-        config.security.paths.denied = [];
-      }
-    }
+    applyAnswersToConfig(config, answers);
     saveConfig(config, configPath, dirname24(configPath));
     getDefaultChannel().writeLine(t("cli.config_saved"));
   });
@@ -39745,16 +39860,16 @@ function buildConfigCommands(program2) {
     saveConfig(config, configPath, dirname24(configPath));
     getDefaultChannel().writeLine(t("cli.set_done", { key, value }));
   });
-  configCmd.command("show").description(t("cli.show_config")).action(async () => {
+  configCmd.command("show").description(t("cli.show_config")).option("--show-secrets", "Print secrets (API keys, tokens) unredacted").action(async (opts) => {
     const { config } = await bootstrap();
-    writeMachineJson(config);
+    writeMachineJson(configForDisplay(config, opts.showSecrets));
   });
   configCmd.command("migrate").description(t("cli.migrate_config")).action(async () => {
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), exports_config));
-    const { hasDomainFiles: hasDomainFiles3 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
+    const { hasDomainFiles: hasDomainFiles2 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
     const configDir = join53(homedir17(), ".mma");
     const configPath = join53(configDir, "config.json");
-    if (hasDomainFiles3(configDir)) {
+    if (hasDomainFiles2(configDir)) {
       getDefaultChannel().writeLine(pc.yellow(t("config.migrate_no_legacy")));
       return;
     }
@@ -40176,6 +40291,7 @@ import * as readline2 from "readline";
 
 // src/ui/line-editor.ts
 init_string_width();
+init_colors();
 import * as readline from "readline";
 
 // src/ui/line-math.ts
@@ -40288,6 +40404,7 @@ class LineEditor {
   pasteLastWasCR = false;
   lastWasCR = false;
   questionCb = null;
+  completionSession = null;
   rawMode = false;
   listeners = {};
   dsrDataHandler;
@@ -40421,6 +40538,7 @@ class LineEditor {
     this.col = 0;
     this.historyIndex = -1;
     this.stash = null;
+    this.completionSession = null;
     this.invalidateAnchor();
     if (this.input.isTTY)
       this.render();
@@ -40431,6 +40549,7 @@ class LineEditor {
     this.lines = [""];
     this.row = 0;
     this.col = 0;
+    this.completionSession = null;
     this.invalidateAnchor();
     if (this.input.isTTY)
       this.render();
@@ -40496,6 +40615,27 @@ class LineEditor {
       }
       return;
     }
+    if (this.completionSession) {
+      const ck = key;
+      const plain = !ck.ctrl && !ck.meta;
+      if (ck?.name === "down" && plain) {
+        this.cycleCompletion(1);
+        return;
+      }
+      if (ck?.name === "up" && plain) {
+        this.cycleCompletion(-1);
+        return;
+      }
+      if (ck?.name === "tab") {
+        this.cycleCompletion(1);
+        return;
+      }
+      if (ck?.name === "escape") {
+        this.cancelCompletion();
+        return;
+      }
+      this.completionSession = null;
+    }
     if (this.onKeyInput && this.onKeyInput(str, key))
       return;
     const k = key;
@@ -40674,6 +40814,7 @@ class LineEditor {
     }
   }
   submit() {
+    this.completionSession = null;
     if (this.questionCb) {
       const cb = this.questionCb;
       this.questionCb = null;
@@ -40729,6 +40870,7 @@ class LineEditor {
     this.lines = [""];
     this.row = 0;
     this.col = 0;
+    this.completionSession = null;
     this.invalidateAnchor();
     this.render();
     if (this.onInterrupt) {
@@ -40753,6 +40895,7 @@ class LineEditor {
     this.lines[this.row] = chars.join("");
   }
   insertText(text) {
+    this.completionSession = null;
     const sanitized = text.replace(/\r\n/g, `
 `).replace(/\r/g, "");
     const chars = this.currentChars();
@@ -40967,6 +41110,7 @@ class LineEditor {
     }
   }
   applyHistoryEntry() {
+    this.completionSession = null;
     const entry = this.history[this.history.length - 1 - this.historyIndex];
     this.lines = entry.split(`
 `);
@@ -40976,6 +41120,49 @@ class LineEditor {
     this.col = charLen(this.lines[this.row]);
     this.render();
   }
+  replaceCompletionToken(from, removeText, insertText) {
+    const line = this.lines[this.row];
+    const head = line.slice(0, from);
+    const tail = line.slice(from + removeText.length);
+    this.lines[this.row] = head + insertText + tail;
+    this.col = charLen(head) + charLen(insertText);
+  }
+  partialStart(line, partial) {
+    const chars = Array.from(line);
+    const beforeCursor = chars.slice(0, this.col).join("");
+    let from = beforeCursor.lastIndexOf(partial);
+    if (from === -1)
+      from = line.lastIndexOf(partial);
+    return from;
+  }
+  applyCompletionCandidate(index) {
+    const s = this.completionSession;
+    if (!s)
+      return;
+    const chosen = s.items[index].value;
+    this.replaceCompletionToken(s.from, s.inserted, chosen);
+    s.index = index;
+    s.inserted = chosen;
+    this.render();
+  }
+  cycleCompletion(delta) {
+    const s = this.completionSession;
+    if (!s)
+      return;
+    const n = s.items.length;
+    if (n === 0)
+      return;
+    const next = (s.index + delta + n) % n;
+    this.applyCompletionCandidate(next);
+  }
+  cancelCompletion() {
+    const s = this.completionSession;
+    if (!s)
+      return;
+    this.replaceCompletionToken(s.from, s.inserted, s.original);
+    this.completionSession = null;
+    this.render();
+  }
   tabComplete() {
     if (!this.completer)
       return;
@@ -40986,28 +41173,53 @@ class LineEditor {
       return;
     }
     if (matches.length === 1) {
-      const chars = Array.from(line);
-      const beforeCursor = chars.slice(0, this.col).join("");
-      let from = beforeCursor.lastIndexOf(partial);
-      if (from === -1)
-        from = line.lastIndexOf(partial);
-      if (from === -1) {
+      const from2 = this.partialStart(line, partial);
+      if (from2 === -1) {
         this.output.write("\x07");
         return;
       }
-      const head = line.slice(0, from);
-      const tail = line.slice(from + partial.length);
-      this.lines[this.row] = head + matches[0] + tail;
-      this.col = charLen(head) + charLen(matches[0]);
+      this.replaceCompletionToken(from2, partial, matches[0].value);
       this.render();
       return;
     }
-    const rows = matches.map((m) => "  " + m);
+    const from = this.partialStart(line, partial);
+    if (from === -1) {
+      this.output.write("\x07");
+      return;
+    }
+    const width = this.columns();
+    const limit = width - 1;
+    const rows = matches.map((m) => {
+      const plain = m.description ? `  ${m.value}  ${m.description}` : `  ${m.value}`;
+      if (limit <= 0)
+        return "";
+      if (stringWidth(plain) <= limit) {
+        return m.description ? `  ${m.value}  ${pc.dim(m.description)}` : `  ${m.value}`;
+      }
+      let acc = "";
+      let w = 0;
+      for (const ch of plain) {
+        const cw = stringWidth(ch);
+        if (w + cw > limit - 1)
+          break;
+        acc += ch;
+        w += cw;
+      }
+      return acc + "…";
+    });
     this.output.write(`\r
 ` + rows.join(`\r
 `) + `\r
 `);
     this.prevCursorRow += rows.length + 1;
+    this.completionSession = {
+      items: matches,
+      index: 0,
+      from,
+      original: partial,
+      inserted: matches[0].value
+    };
+    this.replaceCompletionToken(from, partial, matches[0].value);
     this.render();
   }
   clearScreen() {
@@ -41144,10 +41356,19 @@ class LineEditor {
 
 // src/cli/repl.ts
 import { existsSync as existsSync61, mkdirSync as mkdirSync25, readFileSync as readFileSync42, writeFileSync as writeFileSync24 } from "fs";
-import { dirname as dirname26, join as join55 } from "path";
+import { dirname as dirname26, join as join56 } from "path";
 import { homedir as homedir18 } from "os";
 
 // src/cli/completer.ts
+import { readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { join as join54 } from "path";
+function buildSlashCompletions(commands) {
+  return Array.from(commands.entries()).map(([name, cmd]) => ({
+    name,
+    description: cmd.description
+  }));
+}
+
 class SlashCommandProvider {
   name = "slash-commands";
   commands;
@@ -41158,7 +41379,7 @@ class SlashCommandProvider {
     return ctx.tokenIndex === 0 && ctx.line.startsWith("/");
   }
   complete(ctx) {
-    return this.commands.filter((c) => c.startsWith(ctx.partial.slice(1))).map((c) => `/${c}`);
+    return this.commands.filter((c) => c.name.startsWith(ctx.partial.slice(1))).map((c) => ({ value: `/${c.name}`, description: c.description }));
   }
 }
 
@@ -41168,13 +41389,13 @@ class SubcommandProvider {
   subcommands;
   constructor(command, subcommands) {
     this.command = command;
-    this.subcommands = subcommands;
+    this.subcommands = subcommands.map((s) => typeof s === "string" ? { name: s } : s);
   }
   match(ctx) {
     return ctx.tokenIndex === 1 && ctx.tokens[0] === `/${this.command}`;
   }
   complete(ctx) {
-    return this.subcommands.filter((s) => s.startsWith(ctx.partial));
+    return this.subcommands.filter((s) => s.name.startsWith(ctx.partial)).map((s) => ({ value: s.name, description: s.description }));
   }
 }
 
@@ -41188,9 +41409,44 @@ class ModelArgProvider {
     return ctx.tokenIndex === 2 && ctx.tokens[0] === "/model" && ctx.tokens[1] === "use";
   }
   complete(ctx) {
-    return this.getModels().filter((m) => m.startsWith(ctx.partial));
+    return this.getModels().filter((m) => m.startsWith(ctx.partial)).map((m) => ({ value: m }));
+  }
+}
+
+class FilePathProvider {
+  name = "file-paths";
+  root;
+  constructor(root) {
+    this.root = root;
+  }
+  match(ctx) {
+    return ctx.tokenIndex >= 1 && (ctx.partial.includes("/") || ctx.partial.includes("\\"));
+  }
+  complete(ctx) {
+    try {
+      const cwd = this.root ?? process.cwd();
+      const partialPath = ctx.partial;
+      const lastSlash = Math.max(partialPath.lastIndexOf("/"), partialPath.lastIndexOf("\\"));
+      const dirPath = lastSlash > 0 ? partialPath.slice(0, lastSlash) : ".";
+      const prefix = lastSlash > 0 ? partialPath.slice(0, lastSlash + 1) : "";
+      const fullPath = join54(cwd, dirPath);
+      const entries = readdirSync19(fullPath);
+      const matches = [];
+      for (const entry of entries) {
+        const entryPath = join54(fullPath, entry);
+        const stat2 = statSync11(entryPath);
+        const completion = prefix + entry + (stat2.isDirectory() ? "/" : "");
+        if (completion.startsWith(ctx.partial)) {
+          matches.push(completion);
+        }
+      }
+      return matches.slice(0, 20).map((m) => ({ value: m }));
+    } catch {
+      return [];
+    }
   }
 }
+
 class ProviderArgProvider {
   name = "provider-args";
   providers;
@@ -41201,7 +41457,7 @@ class ProviderArgProvider {
     return ctx.tokenIndex === 2 && ctx.tokens[0] === "/provider" && ctx.tokens[1] === "use";
   }
   complete(ctx) {
-    return this.providers.filter((p) => p.startsWith(ctx.partial));
+    return this.providers.filter((p) => p.startsWith(ctx.partial)).map((p) => ({ value: p }));
   }
 }
 
@@ -41216,9 +41472,8 @@ class SessionNameProvider {
   }
   complete(ctx) {
     const names = this.getNames();
-    if (!ctx.partial)
-      return names;
-    return names.filter((n) => n.toLowerCase().includes(ctx.partial.toLowerCase()));
+    const filtered = !ctx.partial ? names : names.filter((n) => n.toLowerCase().includes(ctx.partial.toLowerCase()));
+    return filtered.map((n) => ({ value: n }));
   }
 }
 
@@ -41240,9 +41495,8 @@ class SkillNameProvider {
     if (!source)
       return [];
     const names = source();
-    if (!ctx.partial)
-      return names;
-    return names.filter((n) => n.toLowerCase().includes(ctx.partial.toLowerCase()));
+    const filtered = !ctx.partial ? names : names.filter((n) => n.toLowerCase().includes(ctx.partial.toLowerCase()));
+    return filtered.map((n) => ({ value: n }));
   }
 }
 
@@ -41354,19 +41608,22 @@ function toolCategory(tool) {
   }
   return "meta";
 }
-function actionMarkFor(tool) {
+function toolAccent(tool) {
   switch (toolCategory(tool)) {
     case "recon":
-      return pc.cyan(glyph.action);
+      return pc.cyan;
     case "mutate":
-      return pc.magenta(glyph.action);
+      return pc.magenta;
     case "execute":
-      return pc.blue(glyph.action);
+      return pc.blue;
     case "meta":
     default:
-      return pc.dim(glyph.action);
+      return pc.dim;
   }
 }
+function actionMarkFor(tool) {
+  return toolAccent(tool)(glyph.action);
+}
 function successMark() {
   return pc.green(glyph.success);
 }
@@ -41861,11 +42118,7 @@ class Renderer {
   meta(chunk) {
     this.spinner.stop();
     if (this.thoughtStarted) {
-      if (!this.thoughtHeaderPrinted) {
-        this.channel.writeRaw(`
-${pc.magenta(glyph.thinking)} ${pc.dim(this.thinkingLabel)} `);
-        this.thoughtHeaderPrinted = true;
-      }
+      this.writeThoughtHeader();
       this.channel.writeRaw(pc.dim(chunk));
     } else if (this.card) {
       this.writeInlineBody(chunk);
@@ -41901,13 +42154,16 @@ ${pc.magenta(glyph.thinking)} ${pc.dim(this.thinkingLabel)} `);
   reasoning(chunk) {
     this.spinner.stop();
     this.flushRecon();
-    if (this.thoughtStarted && !this.thoughtHeaderPrinted) {
-      this.channel.writeRaw(`
-${pc.magenta(glyph.thinking)} ${pc.dim(this.thinkingLabel)} `);
-      this.thoughtHeaderPrinted = true;
-    }
+    this.writeThoughtHeader();
     this.channel.writeRaw(pc.dim(chunk));
   }
+  writeThoughtHeader() {
+    if (!this.thoughtStarted || this.thoughtHeaderPrinted)
+      return;
+    this.channel.writeRaw(`
+${pc.magenta(glyph.thinking)} ${pc.magenta(this.thinkingLabel)} ${pc.dim("·")} `);
+    this.thoughtHeaderPrinted = true;
+  }
   thinkingStart() {
     this.flushRecon();
     this.thoughtStarted = true;
@@ -41946,6 +42202,7 @@ ${pc.magenta(glyph.thinking)} ${pc.dim(this.thinkingLabel)} `);
     const summary = humanArgs(tool, displayArgs);
     const label = friendlyTool(tool);
     const mark = actionMarkFor(tool);
+    const accent = toolAccent(tool);
     const deferred = this.verbosity === "quiet";
     this.card = {
       tool,
@@ -41964,7 +42221,7 @@ ${pc.dim(glyph.detail)} ${pc.cyan(stepContext)}
 `);
     }
     if (!deferred) {
-      this.channel.writeRaw(`${mark} ${label}${summary ? ` ${pc.dim(summary)}` : ""}
+      this.channel.writeRaw(`${mark} ${accent(label)}${summary ? ` ${pc.dim("·")} ${pc.dim(summary)}` : ""}
 `);
     }
     if (!SPINNERLESS_TOOLS.has(tool)) {
@@ -41981,7 +42238,8 @@ ${pc.dim(glyph.detail)} ${pc.cyan(stepContext)}
     this.reconBuffer = [];
     if (items.length === 1) {
       const it = items[0];
-      const head = `${it.mark} ${it.label}${it.summary ? ` ${pc.dim(it.summary)}` : ""}`;
+      const accent = toolAccent(it.tool);
+      const head = `${it.mark} ${accent(it.label)}${it.summary ? ` ${pc.dim("·")} ${pc.dim(it.summary)}` : ""}`;
       this.channel.writeRaw(`${head}  ${successMark()} ${pc.dim(formatDuration(it.duration))}
 `);
       return;
@@ -42018,13 +42276,19 @@ ${pc.dim(glyph.detail)} ${pc.cyan(stepContext)}
     }
     if (deferred) {
       if (!error && RECON_TOOLS.has(this.card.tool)) {
-        this.reconBuffer.push({ mark: leadMark, label, summary, duration });
+        this.reconBuffer.push({
+          tool: this.card.tool,
+          mark: leadMark,
+          label,
+          summary,
+          duration
+        });
         this.recordLast(label, summary, error, duration);
         this.card = null;
         return;
       }
       this.flushRecon();
-      const head = `${leadMark} ${label}${summary ? ` ${pc.dim(summary)}` : ""}`;
+      const head = `${leadMark} ${toolAccent(this.card.tool)(label)}${summary ? ` ${pc.dim("·")} ${pc.dim(summary)}` : ""}`;
       this.channel.writeRaw(`${head}  ${tail}
 `);
       if (error && firstBody) {
@@ -42049,6 +42313,7 @@ ${pc.dim(glyph.detail)} ${pc.cyan(stepContext)}
     const firstBody = this.card?.firstBody ?? "";
     const status = !error ? "ok" : firstBody.startsWith("⚠") ? "warn" : "error";
     recordLastAction({
+      tool: this.card?.tool ?? "",
       label,
       args: summary,
       status,
@@ -42425,10 +42690,10 @@ class Repl {
     this.execModule = execModule;
     this.slog = new SessionLogger(sessionManager, logger4);
     this.bindSessionOutput();
-    this.configDir = configDir || join55(homedir18(), ".mma");
+    this.configDir = configDir || join56(homedir18(), ".mma");
     this.baseDir = baseDir || process.cwd();
     this.noAgentsMd = noAgentsMd === true;
-    this.historyPath = historyPath ?? join55(homedir18(), ".mma", "repl-history");
+    this.historyPath = historyPath ?? join56(homedir18(), ".mma", "repl-history");
     this.loadHistory();
     const editorCompleter = (line) => {
       const [matches, partial] = this.completer.complete(line);
@@ -42436,6 +42701,10 @@ class Repl {
         return [matches, partial];
       return [[], line];
     };
+    const readlineCompleter = (line) => {
+      const [items, partial] = editorCompleter(line);
+      return [items.map((i) => i.value), partial];
+    };
     if (process.stdin.isTTY) {
       this.rl = new LineEditor({
         input: process.stdin,
@@ -42453,7 +42722,7 @@ class Repl {
         history: this.history,
         historySize: this.maxHistory,
         tabSize: 2,
-        completer: editorCompleter
+        completer: readlineCompleter
       });
     }
     this.output = output ?? getDefaultChannel();
@@ -42508,7 +42777,7 @@ class Repl {
     const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), exports_config));
     const { bootstrap: bootstrap2 } = await Promise.resolve().then(() => (init_bootstrap(), exports_bootstrap));
     this.agent.shutdown();
-    const projectConfigPath = join55(this.baseDir, ".mmrc");
+    const projectConfigPath = join56(this.baseDir, ".mmrc");
     const { config: freshConfig } = loadConfig2({
       configDir: this.configDir,
       projectConfigPath
@@ -42548,7 +42817,7 @@ class Repl {
   }
   setupCompleter() {
     this.completer.reset();
-    const slashCommands = Array.from(this.commands.keys());
+    const slashCommands = buildSlashCompletions(this.commands);
     this.completer.registerProvider(new SlashCommandProvider(slashCommands));
     if (this.sessionManager) {
       this.completer.registerProvider(new SessionNameProvider(() => this.sessionManager.list().map((s) => s.name)));
@@ -42564,6 +42833,7 @@ class Repl {
       this.completer.registerProvider(new ProviderArgProvider(entryLabels));
     }
     this.completer.registerProvider(new ModelArgProvider(() => this.modelCache));
+    this.completer.registerProvider(new FilePathProvider(this.baseDir));
     this.refreshModelCache();
   }
   refreshModelCache() {
@@ -42744,7 +43014,8 @@ ${t("repl.interrupt")}`));
       return;
     }
     const mark = last2.status === "error" ? pc.red(glyph.failure) : last2.status === "warn" ? pc.yellow(glyph.warning) : pc.green(glyph.success);
-    const head = `${pc.cyan(glyph.action)} ${last2.label}${last2.args ? ` ${pc.dim(last2.args)}` : ""}  ${mark} ${pc.dim(`${last2.durationMs}ms`)}`;
+    const accent = toolAccent(last2.tool);
+    const head = `${accent(glyph.action)} ${accent(last2.label)}${last2.args ? ` ${pc.dim("·")} ${pc.dim(last2.args)}` : ""}  ${mark} ${pc.dim(`${last2.durationMs}ms`)}`;
     const lines = [head, ...last2.body.map((l) => `  ${l}`)];
     this.output.writeLine(`
 ${lines.join(`
@@ -43022,9 +43293,9 @@ ${divider()}`);
       row(t("repl.agents_label"), pc.red(t("repl.disabled")));
     } else {
       const agentsMdCandidates = [
-        join55(this.baseDir, "AGENTS.md"),
-        join55(this.baseDir, ".mma", "AGENTS.md"),
-        join55(this.configDir, "AGENTS.md")
+        join56(this.baseDir, "AGENTS.md"),
+        join56(this.baseDir, ".mma", "AGENTS.md"),
+        join56(this.configDir, "AGENTS.md")
       ];
       const foundAgents = agentsMdCandidates.filter((p) => existsSync61(p));
       if (foundAgents.length > 0) {
@@ -43037,7 +43308,7 @@ ${divider()}`);
     }
     const meta = this.sessionManager?.getActiveMeta();
     if (meta) {
-      const sessionPath = join55(this.configDir, "sessions", meta.id);
+      const sessionPath = join56(this.configDir, "sessions", meta.id);
       row(t("repl.session_label"), `${pc.cyan(meta.name)} ${pc.dim(`(${meta.id.slice(0, 12)})`)}  —  ${meta.messageCount} msgs  ${pc.dim(sessionPath)}`);
     }
     const isTty2 = process.stdout.isTTY === true;
@@ -43049,9 +43320,9 @@ ${divider()}`);
     try {
       const { existsSync: exists } = await import("fs");
       const { join: pathJoin } = await import("path");
-      const { hasDomainFiles: hasDomainFiles3 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
+      const { hasDomainFiles: hasDomainFiles2 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
       const legacyPath = pathJoin(this.configDir, "config.json");
-      if (exists(legacyPath) && !hasDomainFiles3(this.configDir)) {
+      if (exists(legacyPath) && !hasDomainFiles2(this.configDir)) {
         this.output.writeLine(pc.yellow(`  ${t("config.legacy_hint")}`));
         this.output.writeLine("");
       }
@@ -43166,51 +43437,7 @@ function printRunResult(result, flush, channel = getDefaultChannel()) {
 
 // src/cli/main.ts
 init_setup();
-
-// src/cli/setup-order.ts
-var SECURITY_BASH_BLOCKLIST = [
-  "rm",
-  "dd",
-  "chmod",
-  "wget",
-  "curl",
-  "scp",
-  "ssh",
-  "nc",
-  "netcat",
-  "sudo",
-  "su",
-  "kill",
-  "pkill",
-  "killall",
-  "shutdown",
-  "reboot"
-];
-function applyAnswersToConfig(config, a) {
-  config.provider = {
-    ...config.provider,
-    type: a.provider,
-    baseUrl: a.apiBase,
-    apiKey: a.apiKey
-  };
-  config.model = a.model;
-  config.contextWindow = a.contextWindow;
-  config.maxToolIterations = a.maxToolIterations;
-  config.locale = a.locale;
-  if (config.security) {
-    config.security.enabled = true;
-    config.security.bash.enabled = true;
-    config.security.bash.blockDangerousFlags = a.securityFlagsBlock || config.security.bash.blockDangerousFlags;
-    if (a.securityBashBlock) {
-      config.security.bash.blacklist = [
-        ...new Set([...config.security.bash.blacklist, ...SECURITY_BASH_BLOCKLIST])
-      ];
-    }
-    if (!a.securityPathsDeny)
-      config.security.paths.denied = [];
-  }
-  return config;
-}
+init_setup_order();
 
 // src/cli/relaunch.ts
 init_output();
@@ -43270,7 +43497,7 @@ init_config2();
 init_i18n();
 init_colors();
 import { existsSync as existsSync62 } from "fs";
-import { join as join57, dirname as dirname27 } from "path";
+import { join as join58, dirname as dirname27 } from "path";
 import { homedir as homedir20 } from "os";
 import { fileURLToPath as fileURLToPath6 } from "url";
 
@@ -43392,9 +43619,9 @@ init_data_sanitizer();
 init_i18n();
 init_utils();
 import { appendFileSync as appendFileSync8, mkdirSync as mkdirSync26 } from "fs";
-import { join as join56 } from "path";
+import { join as join57 } from "path";
 import { homedir as homedir19 } from "os";
-var CRASH_LOG_DIR = join56(homedir19(), ".mma", "logs");
+var CRASH_LOG_DIR = join57(homedir19(), ".mma", "logs");
 var CRASH_LOG_FILE = "crash.jsonl";
 function formatCrashEntry(type2, err) {
   const message = errMsg(err);
@@ -43410,7 +43637,7 @@ function formatCrashEntry(type2, err) {
 function writeCrashEntry(dir, entry) {
   try {
     mkdirSync26(dir, { recursive: true });
-    appendFileSync8(join56(dir, CRASH_LOG_FILE), JSON.stringify(entry) + `
+    appendFileSync8(join57(dir, CRASH_LOG_FILE), JSON.stringify(entry) + `
 `, "utf-8");
   } catch {}
 }
@@ -43538,6 +43765,9 @@ async function main() {
     }
     const jsonSink = jsonOpt ? new JsonOutputSink(defaultOutputBus) : undefined;
     const prompt = program2.args.join(" ");
+    const mmaDir = process.env.MMA_CONFIG_DIR || join58(homedir20(), ".mma");
+    const { hasDomainFiles: hasDomainFiles2 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
+    const virgin = !existsSync62(join58(mmaDir, "config.json")) && !hasDomainFiles2(mmaDir);
     const { agent, config, baseDir, legacyDetected, contextProbe } = await bootstrap(undefined, projectDir, noAgentsMd, exitOnComplete, reasoningLevel, contextLog);
     if (verboseOpt)
       config.ui.verbosity = "verbose";
@@ -43545,6 +43775,9 @@ async function main() {
     if (legacyDetected) {
       getDefaultChannel().writeLine(pc.yellow(`  ${t("config.legacy_hint")}`), "stderr");
     }
+    if (virgin && !jsonOpt) {
+      getDefaultChannel().writeLine(pc.yellow(`  ${t("cli.first_run_oneshot")}`), "stderr");
+    }
     if (contextProbe && !jsonOpt) {
       try {
         const probe = await contextProbe;
@@ -43620,16 +43853,16 @@ async function main() {
     await updater?.waitForIdle();
     process.exit(exitCode);
   } else {
-    const mmaDir = process.env.MMA_CONFIG_DIR || join57(homedir20(), ".mma");
-    const legacyConfigPath = join57(mmaDir, "config.json");
+    const mmaDir = process.env.MMA_CONFIG_DIR || join58(homedir20(), ".mma");
+    const legacyConfigPath = join58(mmaDir, "config.json");
     let hasAnyConfig = existsSync62(legacyConfigPath);
     if (!hasAnyConfig) {
       try {
-        const { hasDomainFiles: hasDomainFiles3 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
-        hasAnyConfig = hasDomainFiles3(mmaDir);
+        const { hasDomainFiles: hasDomainFiles2 } = await Promise.resolve().then(() => (init_domains(), exports_domains));
+        hasAnyConfig = hasDomainFiles2(mmaDir);
       } catch {}
     }
-    const projectConfigPath = projectDir ? join57(projectDir, ".mmrc") : join57(process.cwd(), ".mmrc");
+    const projectConfigPath = projectDir ? join58(projectDir, ".mmrc") : join58(process.cwd(), ".mmrc");
     if (!hasAnyConfig && !exitOnComplete && process.env.MMA_POST_SETUP !== "1") {
       getDefaultChannel().writeLine(`
   ` + t("cli.first_run") + `